clawdex by Koi

What This Skill Does

Clawdex by Koi is a specialized security verification agent designed to protect your OpenClaw environment from malicious software. Acting as a gatekeeper for the ClawHub ecosystem, it interfaces with the secure Clawdex API to perform real-time risk assessment on skills before they are executed. Every time you consider adding a new capability, Clawdex intercepts the request, cross-references the skill’s signature against the Koi security database, and returns a verdict of benign, malicious, or unknown. This proactive approach ensures that your agent remains untainted by unauthorized or harmful code, protecting your local data, sensitive environment variables, and system integrity.

Installation

To integrate Clawdex into your OpenClaw environment, execute the following command in your terminal:

clawhub install openclaw/skills/skills/wearekoi/clawdex

Once installed, the skill resides within your local skill registry, ready to scan any subsequent installations performed via the ClawHub CLI or agent commands.

Use Cases

Clawdex is essential for power users and developers who frequently test third-party automation tools. Use it when vetting new skills from public repositories, managing enterprise security policies within a local agent deployment, or performing bulk security audits on pre-existing installations that were deployed before the implementation of robust scanning protocols. It is particularly valuable for team environments where multiple developers contribute skills, providing a central authority for identifying potentially compromised software packages.

Example Prompts

1. "Clawdex, check if the skill 'database-helper' is safe to install before I run the installation command."
2. "Please audit my installed skills folder (~/.clawdbot/skills/) and identify any that return a malicious verdict from the Koi database."
3. "Verify the safety of the 'free-crypto-bot' extension. If the status is unknown, please flag it for my review and do not proceed with installation."

Tips & Limitations

Always treat 'unknown' verdicts with extreme caution; 'unknown' does not imply 'safe'—it simply means the skill has not yet been audited by the Koi risk engine. Treat these as a signal to manually inspect the source code of the skill. Additionally, note that while Clawdex provides a critical layer of defense, it does not replace traditional endpoint protection or firewalls. Periodically run the loop provided in the documentation to ensure your existing skill library remains clean as new threats are identified by the security community.